Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / npm/flowise-components/GHSA-28g4-38q8-3cwc
Advisory ID gitlab/npm/flowise-components/GHSA-28g4-38q8-3cwc
Aliases GHSA-28g4-38q8-3cwc
Summary Flowise: Cypher Injection in GraphCypherQAChain The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-943 Improper Neutralization of Special Elements in Data Query Logic
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/FlowiseAI/Flowise
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc
GHSA-28g4-38q8-3cwc https://github.com/advisories/GHSA-28g4-38q8-3cwc
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.